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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 
oversight responsibilities to promote economy, efficiency, and effectiveness within the department. 

This report addresses the management letter for DHS' FEMA National Flood Insurance Program FY 
2008 financial statements audit. It contains observations and recommendations related to internal 
control that were not required to be reported in the financial statement audit report. The independent 
public accounting firm KPMG LLP (KPMG) performed the audit of DHS' FY 2008 financial 
statements and prepared this management letter. Material weaknesses and other significant 
deficiencies were reported, as required, in KPMG's Independent Auditor's Report, dated November 
14, 2008, which was included in the FY 2008 DHS Annual Financial Report. KPMG is responsible 
for the attached management letter dated November 14, 2008 and the conclusions expressed in it. 
We do not express opinions on DHS' financial statements or internal control or provide conclusions 
on compliance with laws and regulations. 

The recommendations herein have been developed to the best knowledge available to our office, and 
have been discussed in draft with those responsible for implementation. We trust this report will 
result in more effective, efficient, and economical operations. We express our appreciation to all of 
those who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 



NATIONAL FLOOD INSURANCE PROGRAM 



Management Letter for the 
Year Ended September 30, 2008 



KPMG LLP 

2001 M Street, NW 
Washington, DC 20036 



Office of Inspector General, U.S. Department of Homeland Security, and 

Acting Administrator, Mitigation Division, Federal Emergency Management Agency, U.S. 

Department of Homeland Security, 

Washington, DC 

November 14, 2008 

Ladies and Gentlemen: 

We were engaged to audit the balance sheet of the U.S. Department of Homeland Security (DHS) 
as of September 30, 2008, and the related statement of custodial activity for the year then ended 
(referred to herein as "financial statements"). We were not engaged to audit the statements of net 
cost, changes in net position, and budgetary resources for the year ended September 30, 2008 
(referred to herein as "other financial statements"). Because of matters discussed in our 
Independent Auditors ' Report dated November 14, 2008, the scope of our work was not sufficient 
to enable us to express, and we did not express, an opinion on the financial statements as of 
September 30, 2008. 

In connection with our fiscal year 2008 engagement, we were also engaged to consider the 
Federal Emergency Management Agency's (FEMA) internal control over financial reporting 
(internal control) and to test FEMA's compliance with certain provisions of applicable laws, 
regulations, contracts, and grant agreements that could have a direct and material effect on the 
financial statements. Our procedures did not include examining the effectiveness of internal 
control and do not provide assurance on internal control. We have not considered internal control 
since the date of our report. 

During our audit engagement, we noted certain matters involving National Flood Insurance 
Program (NFIP) internal control and other operational matters that are presented for your 
consideration. These comments and recommendations, all of which have been discussed with the 
appropriate members of management of the named insurance companies, are intended to improve 
internal control or result in other operating efficiencies, and are summarized in Exhibit I of this 
letter. 

In addition, we identified certain deficiencies in internal control that we consider to be significant 
deficiencies and material weaknesses, and communicated them in our Independent Auditors ' 
Report, dated November 14, 2008, included in the FY 2008 DHS Annual Financial Report. Our 
findings related to FEMA information technology (IT) controls will be presented in a separate 
letter to the DHS Office of Inspector General and the FEMA Chief Information Officer, and our 
findings related to FEMA's internal controls exclusive of our IT and NFIP findings will be 
presented in a separate letter to the DHS Office of Inspector General and the DHS Chief Financial 
Officer. 



KPMG LLP. KPMG LLP, a U.S. limiied liability partnership, fe 
a men, bar of KPMG iiilarnalional, a Swiss coopsraliva. 



As described above, the scope of our work was not sufficient to express an opinion on the balance 
sheet or statement of custodial activity of DHS as of September 30, 2008, and we were not 
engaged to audit the statements of net cost, changes in net position, and budgetary resources for 
the year ended September 30, 2008. Accordingly, other internal control matters and instances of 
non-compliance may have been identified and reported had we been able to perform all 
procedures necessary to express an opinion on the fiscal year 2008 financial statements and had 
we been engaged to audit the fiscal year 2008 other financial statements. We aim, however, to 
use our knowledge of NFIP gained during our work to make comments and suggestions that we 
hope will be useful to you. 

We would be pleased to discuss these comments and recommendations with you at any time. 

Management's written response to our comments and recommendations has not been subjected to 
the auditing procedures applied in the financial statement audit engagement and, accordingly, we 
express no opinion on it. 

This letter is intended solely for the information and use of DHS management, DHS Office of 
Inspector General, the Office of Management and Budget, U.S. Government Accountability 
Office, the U.S. Congress, and management of the named insurance companies, and is not 
intended to be and should not be used by anyone other than these specified parties. 

Very truly yours, 
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I. INTERNAL CONTROL DEFICIENCIES RELATED TO CLAIM PAYMENTS 
A. Internal Control Deficiencies Identified over Claims Paid - Interim Testing 

Observation 

We randomly selected 9 insurance companies participating in the National Flood Insurance 
Program (NFIP) to perform procedures oyer clainis paid for the period October 1, 2007 through 
April 30, 2008. For each of the 9 companies selected, we tested a random sample of 45 claims 
paid during this seven month period. During this testing of 405 claim payments, we noted the 
following internal control deficiencies and errors: 

/. Loss reserves were not properly established. 




.2. Claim amounts per the Final Report 1 were not within policy limits. 




3. Claim file and the Final Report were not approved before claim payment was 
processed and issued. 



State Farm 


0OORF7641 


08/29/2005 


$10,100.00 




0OORA5788 


09/19/2003 


$15,000.00 




000RB4365 


08/29/2005 ; 


$3,864.52 




00ORP5433 


09/24/2005 


$83,599.74 




0OORA4172 


08/29/2005 : 


$100,000.00 




00ORL7387 . .. 


08/29/2005 


$110,000.00 




0OORD390O 


12/31/2005 


V . $2,661.65 




0OORQ3114 


08/29/2005 


$25,000.00 


Allstate V; 


. 3801417803 


: - . 08/06/2007 v 


$58,116.00 




0805145489 , 


08/29/2005 


$6,732.00 




1803589405 


V 05/24/2007 . 


$15,000.00 




•1805296124 


08/29/2005 


$3,268.00 




1801562172 


08/16/2007 


$6,443.68 :. 




1804514923 


08/25/2007 ■ 


$11,790.90 




. 1806134183 .... 


07/06/2007 y 


$8,532.92 




1807456023 


08/16/2007 


$20,934.41 




: 280038501 1 


08/28/2007 


$14,861.52 




3801310404 


08/09/2007 


$1,072.98 




3801522842 


08/08/2007 


$6,627.83 




0809045024 


\ 08/29/2005 


$15,000.00 



As defined by FEMA, the Filial Report is a form that is completed by the insured.arid the claims adjuster, enabling the 
insured tp claim.lpsses to property due to. uninhabitability, water damage and claims against ah existing mortgage. The 
NFIP requires that a preliminary report be received within 15 days of assignment, and an interim or Final Report not 
later than every 30 days thereafter. . ' V- : : 'y 
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0809375629 


03/01/2007 


. $3,755.28 


1804748893 


04/15/2007 


$2,257.35 


1803287489 


08/21/2007 


$11,222.00 


; 1807508591 


; 08/16/2007 


$2,061.25 


0804209427 


09/24/2005 - 


$15,000.00 


1802052082 


06/28/2006 


$6,000.00 


1803616240 


08/29/2005 


$3,337.23 


0806794772 


08/29/2005 


$10,000.00 


.1806204416 . / 


06/27/2006 


. $13,558.71 


0800992661 


10/19/2007 


$612.96 


0804013696 


05/10/2007 


$8,068.67 


1806143945 


: 04/15/2007 


$2,877.37 


3801326806 


07/16/2007 


. $9,916.00 


0800599698 


- 08/29/2005 


. $70.00 


0803117746 


08/29/2005 


$64,000.00 


0804013696 


05/10/2007 


$8,068.67 


0806525085 


08/29/2005 


. $6,662.00 


1806296214 


04/15/2007 


$508.29 


0809212780 


08/29/2005 


$13,748.63 


2800011450 


08/23/2007 


$2,340.50 


1807628548 


03/06/2008 


$3,000.00 


1805364229 


08/29/2005 


$4,956.00 


0807570049 


12/03/2007 


529,140.28 


1804736823 


08/29/2005 


$15,000.00 


1800049742 


: 10/22/2007 


$8,178.22 


1803234820 


02/06/2008 . 


$6,520.07 


1803615853 


01/08/2008 


$2,565.00 


1805219829 


01/08/2008 


$4,489.70 


3801370796 


04/15/2007 


$1,561.65 


1803605599 


: 02/07/2008 


$9,831.49 


1806817043 


02/21/2008 


$33,754.93 


: 1801525021 


02/21/2008 . 


$4,201.81 


0807580535 . 


. : 03/05/2008 


. 51,945.76 



4, Total amount paid did not agree to amount on Final Report or population file (or to 
one cheek amount if claim had multiple payments), . 




5. Claim payment was not properly authorized. 
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6. Loss adjustment expenses were not in compliance with NFIP Fee Schedule. 




Covansys 


4000039529 


02/07/2008 : 


$7,247.56 


Allstate 


3801310404 


08/09/2007 


■ $0.00 




3801522842 


08/08/2007 


$0.00 




1803287489 


: 08/21/2007 


-. $0.00 




1807508591 


08/16/2007 


$0.00 




0800992661 


10/19/2007 


$0.00 




3801326806 


07/16/2007 


$0.00 




0800599698 


08/29/2005 . 


$60.00 


7. Loss reserve amounts were not adjusted as claim payments were made. For closed 


■. claims, loss reserve amounts were not reduced to zero, 




Hartford Underwriters 


71-00428700-2004 


08/29/2005 


$3,036.88 . 


Allstate 


V- 1807628548 


02/06/2008 


. $3,000.00 



Recommendations 

We recommend that the Federal Emergency Management Agency's (FEMA) Mitigation 
Division: 

1) Follow-up with each of the insurance companies noted above to determine that appropriate 
corrective action has been implemented to address the exceptions noted in our testwork. 

2) Provide increased oversight to insurance companies participating in the NFIP to ensure 
claims files are being processed and reviewed in accordance with NFIP guidelines before 
approval and issuance of claim payments and to ensure the specific and consistent 
establishment and reporting of loss reserves and subsequent adjustments to the loss reserves. 

Management Response 

Management has developed a Management Action Plan to resolve the deficiencies. 
Management's initial attempts to contact the companies with regard to the findings were met with 
requests for policy number and date of loss. Now that KPMG has provided policy numbers and 
dates of loss, management will within 60 days once again contact the companies to determine the 
appropriate corrective action. Management will follow- up with each company to determine that 
the appropriate corrective action has been implemented for each of the areas of deficiency. 
Management will emphasis the issues identified during the audit in its next cycle of Claims 
Operation Reviews. 

In addition, on December 22, 2008, Bulletin W-08095 was sent to Write Your Own (WYO) 
Company Principal Coordinators, the NFIP Servicing Agent, and Selected Claims Adjusting 
Firms Companies. This Bulletin corrected and clarified case reserving procedures the insurers 
must to follow. It must be stated that case reserves created by companies have no significant 
impact on reserves included in the Balance Sheet. Balance Sheet reserves are developed by the 
NFIP Bureau and S tatistical. Agent actuarial staff and is subject to an independent peer review. . 
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B. 



internal Control Deficiencies Identified over Claims Paid - Final Testing 



Observation 

We randomly selected 9 insurance companies to perform procedures over claims paid from the 
period May 1 through July 31, 2008. For each of the 9 companies selected, we tested a random 
sample of 45 claims paid during this three month period. During this testing of 405 claim 
payments, we. noted the following mtemal control deficiencies and en-ors: . 

1. Total amount paid did not agree to amount on Final Report? or population file (or to 
one checlc amount if claim had multiple payments). 



Fidelity. 


2510091424 ; 


. . 06/13/2008 


: . $8,531.28 




7700718599 


04/09/2008 


:/ $2,065,87 ; 


American Bankers 


PJ00511094 


. . 03/19/2008 


$1,064.50 


Hartford Underwriters 


72-00029512-2008 


06/12/2008 


$8,809.40 




72-00012670-2008 


04/13/2008 


$10,046.94 



2. . Loss adjustment expenses were. nat in compliance with the NFIP Fee Schedule. 



Allstate ' 


' 0802911032 


08/29/2005 


$0.00 




1805895974 


08/29/2005 


$250.00 


Covansys 


202410165:7 


. 03/19/2008 


$13,295.42 


Fidelity . 


7700718599 


04/09/2008 


$500.00 


American Bankers 


2023977000 


03/21/2008 . 


$1,980.56 




2027539600. 


05/13/2008 


. $3,545.80 




0790016823 


03/17/2008 


$1,764.18 




AB000 10554 


06/08/2008 


$2,091.03 




3019033500 


07/01/2007 


$5,469.94 .. 




790016823 


03/17/2008 


$1,764.18 




AB000 10554 


06/08/2008 


■ $2,091.03 : 


Hartford Underwriters ■ ■ ■ : 


72-00018411-2008 


03/18/2008 


$850.00 



3. Loss reserve amounts were not adjusted. as claim payments were made. For closed 
claims, loss reserve amounts were not reduced to zero. 



State Farm 


RD6993 
RB0794 


01/08/2008 
03/22/2008 


$4,576.50 
$14,796.00 


Allstate 


1807313208 


05/13/2008 


$7,654.98 



Recommendations 

We recommend that FEMA's Mitigation Division: 

1) Follow-up with each of the insurance' companies noted above to determine that appropriate 
corrective action has been implemented to address the exceptions noted in our testwork. 

2) Provide increased oversight to insurance companies participating in the NFIP to ensure 
claims files are being processed and reviewed in accordance with NFIP guidelines before 
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approval and issuance of claim payments and to ensure the specific and consistent 
establishment and reporting of loss reserves and subsequent adjustments to the loss reserves; 

Management Response 

Management has developed a Management : Action Plan to resolve the deficiencies. 
Management's initial attempts to contact the companies with regard to the findings were met with 
requests for policy number and date of loss. Now mat KPMG has provided policy numbers and 
dates of loss, management will Within 60 days once again contact the companies to determine the 
appropriate corrective action. Management will followT up with each company to determine that 
the appropriate corrective action has been implemented for each of the areas of deficiency. 
Management will emphasis the issues identified during the audit in its next cycle of Claims 
Operation Reviews. 

In addition, on December 22, 2008, Bulletin W-08095 was sent to Write Your Own (WYO) 
Company Principal Coordinators, the NF1P Servicing Agent, and Selected Claims Adjusting 
Firms Companies. This Bulletin corrected and clarified case reserving procedures the insurers 
must to follow. It must be stated that case reserves created by companies have no significant 
impact on reserves included in the Balance Sheet. Balance Sheet reserves are developed by the 
NFIP Bureau and Statistical Agent actuarial staff and is subject to an independent peer review. : 

C. Inaccuracies in Interim Claims' Loss Reserves 

Observation - April 30, 2008 

We randomly selected 9 insurance companies to perform procedures over the accuracy and 
completeness of loss reserves established as of April 30, 2008. For each of the 9 companies 
selected, we tested a random sample of 30 loss reserves reported as of April 30, 2008. During 
this testing of 270 items, we identified 1 instance where the appropriate amount of the loss 
reserve was not established as compared to the information obtained in the claim file and 3 
instances where the loss reserve was not closed in a timely manner after full payment of the claim 
was made to the policyholder. See below for details: 

1. . -Loss ? reserve not established as compared to the information in the claim 




2. Loss reserve was not closed in a timely manner after full payment of the claim was 
made to the policyholder: - 



Fidelity - FN1C 


2510057861 


08/29/2005 


$97,493.46 




2510071183 


08/29/2005 . 


$34,600.00 : 


Hartford Underwriters 


71-00428700-2004 


08/29/2005 


$30,000.00 



£5 
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Observation - July 31, 2008 

We randomly selected 9 2 insurance companies to perform procedures over the accuracy and 
completeness of loss reserves established as of July 31, 2008. For each of the 9 companies 
selected, we tested a random sample of 35 loss reserves reported as of July 31, 2008. During this 
testing of 3 15 items, we identified 13 instances where the supporting documentation received did 
hot support the loss reserve balance, 2 instances where the loss reserve was not updated based on 
receipt of the Preliminary Report, 12 instances (10 of 12 related to Increased Cost of Compliance 
(ICC) claims) where the loss reserve was not reduced for an advanced payment or partial 
payment, 1 instance where the loss reserve was not closed in a timely manner after full payment 
of the claim was made to the policyholder, and 3 instances where the inaccurate amount of the 
loss reserve was caused by a data input error. See below for the claim numbers associated with 
these exceptions at the respective insurance companies: 

3. Supporting documentation received did not support the loss reserve balance: 



Allstate 


1804402285 


08/29/2005 


$800.00 




1801847615 


. 08/28/2005 


$15,000.00 




0808970347 


08/29/2005 


$100.00 




1802762136 


v 08/29/2005 


$160.00 




1807230055 


. 08/21/2007 


$9,250.00 




1803908837 


08/29/2005 


$12,000.00 




. 3801039797 


06/07/2008 


$44,000.00 




0805784279 


06/07/2008 


$19,500.00 




:. 1806533137 


06/13/2008 


$20,000.00 




:. 1805201629 


06/04/2008 


$15,300.00 




. 0801554486. 


08/21/2007 . 


$10,000.00 




.0807873153 


■ 08/22/2007 


'.. $12,000.00 


. Travelers 


6010042916 


06/18/2008 


$17,385.00 



4. Loss reserve was not updated based on receipt of the Preliminary Report: 



American Bankers 


2036461900 


1 06/25/2008 


$700,000.00 1 




AB000 11921 


1 07/09/2008 


$10,000.00 1 



Loss reserve was not reduced for an advanced payment or partial payment: 



. Hartford Eire 



99013809642005 
87040381452007 
1240922972004 
87021341032007 
99027857312007 



08/29/2005 
08/24/2007 
08/29/2005 
06/20/2008 
06/08/2008 



$30,000.00 
$30,000.00 
$30,000.00 
$33,692.64 
$.78,000.00 



On July 1, 2008, Fidelity National Insurance Company (FNIC) merged with Fidelity National Property & 
Casualty Insurance (FNP AC). As a result, the loss reserve test work as of July 31* 2008 for both companies 
selected was performed under FNPAC. . r - ■ . • 
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Hartford Underwriters 


71004287002004 


08/29/2005 . 


$30,000.00 




72000074472005 


08/29/2005 


$30,000.00 




7000030275.2005 


08/30/2005 


$30,000.00 




71000166202005 : 


08/29/2005 : 


: $30,000.00 




72000205872005 


08/29/2005 


: $30,000.00 


State Farm : 


000RB4278 


■ 08/29/2005 - 


$30,000.00 




000D60066 . 


08/31/2005 


$30,000.00 



Loss reserve was not closed in a timely manner after full payment of the claim was 
made to the policyholder: 




7. Inaccurate amount of the loss reserve was caused by a data input error: 



■ Covansys . 


4000051600 


06/15/2008 


$17,000.00 


Travelers 


6005372542 


06/04/2008 


$70,000.00 


Hartford Fire 


99014551022008 


06/16/2008 


$35,848.32 



Recommendations 

We recommend that FEMA's Mitigation Division: . 

1) Follow-up with each of the insurance companies noted above to determine that appropriate 
: corrective action has been implemented to address the exceptions noted in our testwork. 

2) Provide increased oversight to ensure the specific and consistent documentation over the 
establishment of the loss reserve and subsequent adjustment to the loss reserve per claim in 
the claim file at the insurance companies participating in the NFIP. . 

Management Response ■ 

Management has developed a Management Action Plan to resolve the deficiencies. 
Management's initial attempts to i contact the; companies with . regard to the findings were met with 
requests for policy number and date of loss. Now that KPMG has provided policy numbers and 
dates of loss, management will within 60 days once again contact the companies to determine the . 
appropriate corrective action. Management will follow- up with each company to determine that 
the appropriate corrective action has been implemented for each of the areas of deficiency. 
Management will emphasis the issues identified during the audit in its next cycle of Claims 
Operation Reviews. 

In addition, on December 22, 2008, Bulletin W-08095 was sent to Write Your Own (WYO) 
Company Principal Coordinators, the NFIP Servicing Agent, and Selected Claims Adjusting 
Firms Companies. This Bulletin corrected and clarified case reserving procedures the insurers are 
to follow. It must be stated that case reserves created by companies have no significant impact on 
reserves included in the Balance Sheet. Balance Sheet reserves. are : developed by the NFIP 
Bureau arid Statistical Agent actuarial staff and is subject to an independent peer review. : 
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D. Internal Control Deficiencies in the Claims Reinspection Program 

Observation 

Throughout the year, the NFIP third party service provider conducts a Claims Reinspection . 
Program. The reinspection process involves reviewing existing flood claims for propriety and 
accuracy. Requests for reinspections come from the insurance companies participating in the 
NFIP or FKMA, or if 400 or more claims are reported under a single flood event, the service 
provider is required to select a random sample of open and closed claims for reinspection. 
During our testwork as of April 30, 2008 over a sample of 35 claim reinspections, we identified 
the following exceptions: 

• For 15 sample items, the NFIP insurance company did not receive the claims reinspection 
report from FEMA or its service provider as required in the Financial Control Plan 
Requirements and Procedures. See below for applicable claim numbers. 

RL00035682 
6005402802 
3000279117 
7700094227 
■ 1803603362 
6004202740 
6002670898 
6005007247 
6010050831 

■ 6010042029 
. . 6001909347 

6010055601 
. 2565845043 

■ 6001444659 •. 
4000001545 

• For 2 sample items, required follow-up was not performed on the results of the reinspections. 
We reviewed the results of these reinspections and identified that the service provider's 
claims adjuster made recommendations that the NFIP insurance company should have taken 
action on. See below for applicable claim numbers. 

. 0615RB3085 ' 
1927557646 

• For 1 sample item (claim number 7700635553), adequate follow-up was not performed with 
: the insurance company to ensure the company followed the conclusions reached in the 

reinspection. The insurance company did not follow the conclusions reached by FEMA and 
instead decided to maintain its prior decision. 

Recommendations 

We recommend that FEMA's Mitigation Division: 

1) In conjunction with the service, provider, work with the NextGen system developer to ensure 
the new system addresses the functionality and data reporting needs of the claims adjusters to 
properly carryout the Claints Reiuspection Program., . 
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2) Provide increased oversight to ensure the Claims. Reinspection Program is operating 
according to policies and procedures outlined in Part 3 of the Financial Control Plan 
Requirements and Procedures. 

Management Response 

Management will ensure that the required coordination between the new B&S A contractor and 
the new NFIP service contractor occurs. These contractors are in the. process of transitioning and 
when the transition is complete, management will address this recommendation. Since October 
2008, the current contractor (CSC) is using systems developed by the new contractor to randomly 
select claim files for reinspection using the definition provided by the of the Office of Inspector 
General. By June 2009 new standard operating procedures, reporting of findings, and tracking of 
reinspections will be in place. All of these and other system enhancements should be available 
through the new contractor, IService. 



H. INTERNA!, CONTROL DEFICIENCIES RELATED TO PREMIUMS WRITTEN 
A. Internal Control Deficiencies Identified over Premiums Written 



Observation 

We randomly selected 9 insurance companies to perform procedures oyer flood insurance 
premiums written during the period October 1, 2007 through April 30, 2008. For the 9 
companies selected, we noted the following internal control deficiencies related to our 405 
sample items: 

/. Check did not agree with the appropriate policy. 





' ' -hc;;.:>w | 


V State Farm 


13103852950RA0 




1 96098082 10DJ7 . 




19609861220RV4 




22609859 160D02 




25305306070RR6 



2. Check received from insured was not in the name of the company issuing the policy. 





State Farm 


13103852950RA0 




1 96098082 10DJ7 




1 960986 1220RV4 




22609859 160D02 




25305306070RR6 




21 60905 5640RA1 



Recommendations 

We recommend that FEMA's Mitigation Division: 



1) Follow-up with the insurance company noted above to determine that appropriate corrective 
action has been implemented to address the exceptions noted in our testwork. 

2) Provide increased oversight to insurance companies participating in the NFIP to ensure 
■policies .written are being processed and reviewed in accordance with NFIP guidelines 
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relating to premium payments received from policyholders and to ensure NFIP insurance 
companies are maintaining supporting documentation relating to premium receipts. 

Management Response 

Management will follow-up with the insurance company to determine that appropriate corrective 
action has been implemented to address the exceptions noted. Management will provide 
/ increased oversight to insurance companies participating in the NFIP as noted in this NFR. . 

B. Internal Control Deficiencies in the Submit for Rate Program 

Observation 

The NFIP third party service provider conducts a Submit for Rate Program over the insurance 
companies participating in the NFIP for all new submit for rate policy business for the fiscal year 
(approximately 12,00044,000 policies). The service provider reviews the packages to determine 
if the policies were underwritten correctly. During our testwork as of April 30, 2008 over a 
sample of 35 Submit for Rate policies under the Submit for Rate Program, we identified that the 
service provider's documentation of the Submit for Rate underwriters' review and follow-up on 
underwriting errors was not consistently maintained for all items tested. See below for applicable 
policy numbers. 



7700903569 
: 4100351602 
6010098957 
af71230357 
2108RC15363 
9904146152 
8703041789 
AB00014502 
1338RG289.15 
FL1 1036788 
AF73 120267 
FL1 1033897 
2740RE28528 
3801740220 
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Recommendations 

We recommend that FEMA's Mitigation Division: 

1) Develop and implement policies and procedures that require the servicing agent to maintain 
specific documentation evidencing the procedures performed during the servicing agent's 
review of and follow-up on Submit for Rate policies. 

2) Develop and implement a process to adequately monitor the review procedures performed by 
the servicing agent under the Submit for Rate Program. 

Management Response 

Management does not agree with this deficiency because the Bureau and Statistical Agent (BSA) 
reviews Submit for Rate (SFR) files for all risks that meet the SFR criteria; Many SFRs are 
quotes that never become actual flood insurance policies. It would be time consuming and costly 
for the BSA to identify and compare quotes with that the actual insurance policies that result from 
them. This would entail a monthly search of the policy master file by property address to 
determine whether a policy was actually issued. 

instead, BSA underwriters have been instructed to advise FEMA when a WYO company or ' 
vendor consistently make errors in calculating rates. When a trend is identified, FEMA's and the 
BSA's underwriters provide training to the WYO Company or, if the situation is not resolved, do 
not allow the company to have SFR authority. When a SFR issue surfaces, FEMA may chose to 
examine a company's SFR polices as part of an underwriting operational review. 

We expect this issue to be resolved when the new NextGen system is operational. All SFRs 
submitted to the BSA will be calculated by the new rating engine and, when the property address ■ 
is entered into the system as a policy in force, the actual rate will be matched to the quoted rate. 

HI. OTHER INTERNAL CONTROL DEFICIENCY 

A. Insufficient Documentation of Methodology Used to Calculate NFIP Estimates 
Reported in the FEMA Financial Statements \ 

Observation 

Wc reviewed the estimate methodology for deferred revenue, deferred acquisition cost, and 
accounts payable. The methodology used by the service.provider is insufficiently documented to 
allow a reasonable person to re-perform the year-end estimates and yield the same results. The 
final estimates rely heavily on undocumented management judgments, historical knowledge, 
and/or assumptions to determine the final value" of account balances reported in the NFIP 
financial statements and ultimately recorded in the FEMA financial statements. . 
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Recommendations 

We recommend that FEMA require: 

.1 ) The NFIP third party service provider to sufficiently document the estimation methodology to 
determine the year-end NFIP financial statement amounts by incorporating quantitative 
factors to use based on the level of year-end hurricane/flooding activity, when appropriate. 

2) A formal review and approval of this methodology by a knowledgeable individual within 
FEMA's Office of the Chief Financial Officer once the methodology is fully documented and 
when changes are made to it. 

Management Response 

Management will review and as necessary update the documentation of the estimation process 
prior to the next audit cycle. 

It is recommended that the NFIP incorporate "...quantitative factors to use based on the level of 
year-end hurricane/flooding activity." Management does not concur with this recommendation, 
however Management will review and as necessary update the documentation of the estimation 
process which currently incorporates estimated amounts based on the level of year-end 
hurricane/flooding activity provideddirectly by all reporting entities. 

The management letter is not accurate in stating that the current estimation process omits 
"quantitative factors to use based on the level of year-end hurricane/flooding activity." It is also 
not accurate to state that "Although the methodology discussed above is used to estimate all line 
items on the. NFIP balance-sheet and NFIP income statement except for the actuarial estimate for 
the loss reserve.,." These are not accurate because each WYO Company, the Servicing Agent, 
and the actuary separately provided estimated amounts for September 2008 which include 
"quantitative factors based on their level of year-end hurricane/flooding activity. In this regard; 
KPMG was provided a copy of the letter which specifically requested that the following selected 
estimates be reported for September 2008. 

From All Companies 

• Written premium 

• Claims paid 

• Accounts payable 

• Claims payable ";. 
From the Actuary 

• Actuarial loss reserves .. . 

• Actuarial loss adjustment expenses 

• Actuarial development of paid claims 

The above data estimates represent the material line items on the estimated financial statements 
and are provided directly by the WYO Companies, the Servicing Agent, and the actuary. Each 
data estimate includes the "level of year-end hurricane/flooding activity" for September and it 
was reported as received by the NFIP third party service provider. Neither trending nor analytic 
judgment was applied to these data estimates. 

The "management letter states that "... we focused our review of the methodology on deferred 
revenue, deferred acquisition cost, and accounts payable." Deferred revenue and deferred 
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acquisition costs are a function of premium and are not impacted by year-end hurricane/flooding 
activity as inferred as a resulting Condition by this NFR. 

Finally, the accounts payable as noted above was provided directly by each WYO Company and 
the Servicing Agent, and does incorporate their respective impact on the level of year-end 
hurricane/flooding activity. Again, there is no trending or analytic judgment applied to these data 
estimates. 

Only remaining non-material line items are the only estimates based upon historical trends which 
are consistent year over year and applied by the NFIP third party service provider. Only in these 
isolated data estimates is quantifiable historical trending applied. Analysis (or judgment as 
referred in the management letter) of these non-material items is applied to eliminate non- 
recurring values. More important, these line items do not vary with the impact of any year-end 
hurricane/flooding activity. 
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OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 
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